CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 918 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-15864 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2019 | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. | ||
| CVE-2019-15842 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. | ||
| CVE-2019-15838 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. | ||
| CVE-2019-15833 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. | ||
| CVE-2019-15817 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The easy-property-listings plugin before 3.4 for WordPress has XSS. | ||
| CVE-2018-18370 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in… | ||
| CVE-2018-15512 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | Cross-site scripting (XSS) vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-15511 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | Cross-site scripting (XSS) vulnerability in the 'Notification template' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-15510 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2019 | Cross-site scripting (XSS) vulnerability in the 'Certificate' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2019-13407 | Med | 0.40 | 6.1 | 0.01 | Aug 29, 2019 | A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly. | ||
| CVE-2019-5590 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form. | ||
| CVE-2019-13189 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. | ||
| CVE-2015-9359 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9379 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9378 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9377 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9376 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9375 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9374 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | ||
| CVE-2015-9373 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
- risk 0.40cvss 6.1epss 0.01
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
- risk 0.40cvss 6.1epss 0.01
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
The easy-property-listings plugin before 3.4 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the 'Notification template' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the 'Certificate' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
- risk 0.40cvss 6.1epss 0.01
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cross Site Scripting) via attack reports generated in HTML form.
- risk 0.40cvss 6.1epss 0.01
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.
- risk 0.40cvss 6.1epss 0.01
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- risk 0.40cvss 6.1epss 0.01
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().